Applicant Privacy Policy

1. About This Privacy Policy

This Applicant Privacy Policy explains how CleanSheet Group (“CSG”, “we”, “us” or “our”) collects, uses, verifies, stores, shares, transfers and protects personal data in connection with verification, background screening and related services. We are committed to protecting your personal data and processing it responsibly and in accordance with applicable data protection and privacy laws.

Depending on the service and contractual arrangement, CleanSheet Group may act as a data controller, where we determine the purposes and means of processing, or as a data processor / service provider, where we process personal data on behalf of and in accordance with the instructions of a client. Where we act solely as a processor, the relevant client remains responsible for determining the purposes and legal basis for processing, the client’s own privacy terms may also apply, and certain requests relating to your personal data may need to be addressed to that client.

This Policy explains:

• What personal data we collect;
• How we obtain it;
• How and why we use it;
• The legal basis for processing;
• Who we share it with;
• International transfers;
• How long we retain it;
• How we protect it; and
• Your rights regarding your personal data.

Please read this Policy carefully before providing personal data to CleanSheet Group.

2. When We Act as a Controller

CleanSheet Group may act as a controller when it determines the purposes and means of processing personal data, including where we:

• Provide verification or background screening services directly to an applicant;
• Administer our websites and portals;
• Manage applicant or client accounts;
• Communicate directly with individuals;
• Process payments where applicable;
• Maintain appropriate business, security and compliance records; or
• Process personal data for our own legitimate business and legal purposes.

Where CleanSheet Group processes personal data solely on the instructions of a client, that client may be the controller and CleanSheet Group acts as its processor or service provider.

3. Personal Data We May Collect

The personal data we collect depends on the service requested and the verification being performed. Where relevant and permitted by applicable law, this may include:

Identity and Contact Information

• Full name and previous names;
• Date of birth;
• Nationality;
• Photograph;
• Passport or national identification information;
• Address;
• Telephone number; and
• Email address.

Education and Qualification Information

• Educational institutions attended;
• Qualifications and degrees;
• Certificates;
• Dates of attendance and graduation;
• Student, registration or enrolment numbers;
• Transcripts and academic records;
• Professional training; and
• Other education-related information.

Employment and Professional Information

• Current and previous employers;
• Job titles and positions;
• Employment dates;
• Professional experience;
• References;
• Professional memberships;
• Licenses and registrations; and
• Other information relating to professional qualifications or experience.

Application and Verification Information

• Information and documents submitted by you or our client;
• Application and case reference information;
• Verification responses received from issuing authorities or other sources;
• Discrepancies identified during verification;
• Correspondence relating to a verification; and
• Verification status, findings and reports.

Immigration and Right-to-Work Information

Where relevant to the requested service, this may include visa, residency, immigration and right-to-work information.

Payment Information

Where you pay directly for a service, we may process information necessary to administer and confirm payment. Payment card or banking information may also be processed by authorized payment service providers.

Public and Regulatory Information

Where permitted by applicable law and relevant to the requested service, we may obtain information from public, professional, licensing, regulatory or government sources.

Sensitive or Special Categories of Personal Data

Certain services may involve information considered sensitive or subject to additional legal protection, including information relating to criminal convictions or offences. CleanSheet Group will process such information only where necessary for the requested service and where permitted or required by applicable law.

4. How We Obtain Personal Data

We may obtain personal data:

• Directly from you;
• From the organization requesting the verification;
• Through CleanSheet Group websites or portals;
• From documents and information uploaded to our systems;
• From educational institutions;
• From current or previous employers;
• From government, licensing or regulatory authorities;
• From professional organizations;
• From referees;
• From authorized verification partners or service providers;
• From publicly available or official sources where permitted by law; and
• Through integrations with client or third-party systems where authorized.

When conducting verification, CleanSheet Group may compare information provided by you or our client with information obtained directly from the relevant issuing or authoritative source.

5. How We Use Personal Data

CleanSheet Group may process personal data for the following purposes:

• Verifying identity and documents;
• Verifying education, employment, professional qualifications, licenses, registrations, memberships and references;
• Performing background screening or other verification services requested by you or our client;
• Communicating with issuing authorities and verification sources;
• Identifying discrepancies or inconsistencies;
• Preparing and delivering verification reports;
• Managing applications and cases;
• Communicating with applicants and clients;
• Providing applicant support;
• Processing and confirming payments;
• Operating and improving our websites, portals and services;
• Maintaining service quality and operational performance;
• Preventing fraud, misuse and security incidents;
• Complying with contractual, regulatory and legal obligations; and
• Establishing, exercising or defending legal rights.

CleanSheet Group will not use personal data for purposes that are incompatible with the purpose for which it was collected unless permitted or required by applicable law.

6. Legal Basis for Processing

The legal basis on which CleanSheet Group processes personal data depends on the nature of the service, the relationship between the parties and applicable law. Where required, processing may be based on one or more of the following:

• Consent – where you have authorized CleanSheet Group to process or verify your personal data.
• Contractual necessity – where processing is necessary to provide a service requested by you or to perform contractual obligations.
• Legitimate interests – where processing is necessary for legitimate business or verification purposes and those interests are not overridden by your applicable rights.
• Legal or regulatory obligations – where processing is necessary to comply with applicable laws, regulations, court orders or regulatory requirements.
• Other lawful bases available under applicable data protection law.

Where CleanSheet Group processes personal data solely on behalf of a client, the client is responsible for determining the applicable legal basis unless otherwise required by law.

Where consent is required, you may have the right to withdraw that consent. Withdrawal does not affect processing that was lawfully carried out before consent was withdrawn and may affect CleanSheet Group’s ability to complete a requested verification.

7. Verification and Disclosure to Sources

To perform verification services, CleanSheet Group may disclose relevant personal data and copies of supporting documents to organizations or individuals capable of confirming the information. These may include:

• Universities and other educational institutions;
• Current or former employers;
• Government authorities;
• Licensing and regulatory bodies;
• Professional organizations;
• Referees; and
• Other legitimate issuing or authoritative sources.

Only information reasonably necessary to perform the relevant verification will be disclosed. Information received from verification sources may be recorded, assessed and included in the verification results provided to the authorized recipient.

8. Who We May Share Personal Data With

Where necessary and permitted by applicable law, CleanSheet Group may share personal data with:

• The client or authorized organization requesting the verification;
• CleanSheet Group affiliates and subsidiaries involved in providing the service;
• Authorized verification partners;
• Technology, hosting and infrastructure providers;
• Communication and support service providers;
• Payment service providers;
• Professional advisers, auditors and insurers where necessary;
• Government, regulatory, judicial or law-enforcement authorities where legally required; and
• Other service providers necessary to deliver the requested service.

Third parties processing personal data on behalf of CleanSheet Group are expected to process such information only for authorized purposes and subject to appropriate confidentiality, privacy and security obligations.

If CleanSheet Group undergoes a merger, acquisition, restructuring or transfer of all or part of its business, relevant personal data may be transferred as part of that transaction, subject to applicable legal requirements.

9. International Transfers

Verification is inherently international and may require CleanSheet Group to communicate with institutions, employers, authorities, partners or service providers located in countries other than the country in which the applicant or client is located. Personal data may therefore be processed or transferred internationally where necessary to perform the requested service.

Where required by applicable law, CleanSheet Group will take appropriate measures to protect personal data transferred internationally, which may include contractual safeguards, approved transfer mechanisms, consent where appropriate, or other legally recognized measures.

10. Data Retention

CleanSheet Group retains personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable contractual, legal, regulatory, security and dispute-resolution requirements.

Unless a different period is required by applicable law, contractual requirements or the instructions of a client where CleanSheet Group acts as processor, verification records will generally be retained for up to thirteen (13) years following completion of the relevant service.

Certain information may be retained for a longer or shorter period where necessary to:

• Comply with legal or regulatory requirements;
• Establish, exercise or defend legal claims;
• Investigate fraud or security incidents;
• Comply with contractual obligations; or
• Follow documented client instructions where CleanSheet Group acts as processor.

When personal data is no longer required, CleanSheet Group will take appropriate steps to securely delete, anonymize or otherwise dispose of it in accordance with applicable requirements.

11. Security of Personal Data

CleanSheet Group uses appropriate technical and organizational measures designed to protect personal data against unauthorized access, use, disclosure, alteration, loss or destruction. These measures may include, as appropriate:

• Access controls and authorization procedures;
• Secure systems and infrastructure;
• Authentication controls;
• Encryption and other security technologies;
• Monitoring and logging;
• Backup and recovery procedures;
• Confidentiality requirements;
• Information security policies and procedures; and
• Employee awareness and training.

Access to personal data is limited to authorized personnel and service providers who require access for legitimate business purposes. While CleanSheet Group takes reasonable measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

12. Websites, Portals and Cookies

When you use a CleanSheet Group website or online portal, certain technical information may be collected automatically, such as:

• IP address;
• Browser and device information;
• Date and time of access;
• Pages or services accessed; and
• Technical logs required for security, functionality and performance.

CleanSheet Group may use cookies and similar technologies to operate its websites, maintain security, remember preferences and understand how its digital services are used. Where required by applicable law, non-essential cookies will be used only after obtaining appropriate consent. Further information may be provided through the applicable cookie notice or consent mechanism displayed on the relevant website.

13. Your Data Protection Rights

Depending on your location and applicable data protection law, you may have certain rights regarding your personal data, including the right to:

• Access personal data held about you;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data where legally applicable;
• Restrict processing in certain circumstances;
• Object to processing where the applicable law provides such a right;
• Withdraw consent where processing is based on consent;
• Request data portability where applicable;
• Request information about the processing and disclosure of your personal data; and
• Raise a complaint with CleanSheet Group or an applicable data protection authority.

These rights are subject to applicable law and may not apply in every circumstance. For example, CleanSheet Group may need to retain or continue processing certain information where required by law, necessary for legal claims, or where another lawful basis applies.

Where CleanSheet Group processes your personal data solely on behalf of a client, we may refer your request to the relevant client or assist the client in responding to it. CleanSheet Group may take reasonable steps to verify your identity before processing a request relating to personal data.

14. Automated Decision-Making

CleanSheet Group may use technology and automation to support the administration and delivery of its services. Unless specifically disclosed otherwise, CleanSheet Group does not rely solely on automated processing to make decisions that produce significant legal or similarly significant effects on an individual.

Where automated decision-making is used and specific rights apply under applicable law, CleanSheet Group will provide the information and safeguards required by that law.

15. Changes to This Privacy Policy

CleanSheet Group may update this Privacy Policy from time to time to reflect changes in our services, technology, business operations or applicable legal and regulatory requirements.

The latest version will be made available through the relevant CleanSheet Group website or portal. The “Last Updated” date at the beginning of this Policy will indicate when the Policy was most recently revised. Where required by applicable law, CleanSheet Group will provide additional notice or obtain consent for material changes.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise an applicable data protection right, or have a concern regarding the processing of your personal data, please contact:

CleanSheet Group
Email: [email protected]

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to our Data Security Office via the Support Page on the CleanSheet Group website: https://cleansheetgroup.com/contact/

Where required, CleanSheet Group may request additional information to verify your identity before responding to a request concerning personal data. You may also have the right to contact the relevant data protection or supervisory authority in your jurisdiction.